Thursday, September 15, 2011

Providence police, hospitals at odds in medical privacy debate

A judge in a murder trial in June wanted to see the medical records of a woman whose husband was charged with killing her.

Rhode Island Hospital’s records department rejected the court order –– and answered the subsequent subpoena by saying the law allowed 20 days to respond.

A Providence detective investigating an alleged murder requested the medical records of the victim, who died at Rhode Island Hospital. In his request for the records in March 2010 — nearly two years after the death –– the detective included a copy of the victim’s death certificate, plus two signed releases from the man’s father and adult son.

Rhode Island Hospital refused.

In March, the Providence police wanted to know if a man who’d been shot was still alive, before the suspect accused of shooting him was released on bail. If the victim was dead, the suspect would be held for murder.

Rhode Island Hospital wouldn’t say whether the wounded man existed.

Providence Detective Sgt. James Marsland sighs in frustration as he tells these stories.

“We call over to the hospital to find out his condition: Is he dead or alive? That’s the only medical information I want.

The federal Health Insurance Portability and Accountability Act, known as HIPAA, was designed to protect the privacy of medical databases and imposes hefty fines against those who release patients’ protected information. Even so, the federal law allows the release of some information to law enforcement, such as when the police need to identify a suspect, fugitive or material witness, or when the police are investigating whether a patient is a victim of a crime.

States have their own versions of patient privacy laws, and Rhode Island’s Health Care Confidentiality Law, written in 1978 and adapted over the years, is even more restrictive than the federal law.

The state’s law requires health-care providers to release information to law enforcement about specific kinds of cases, including those involving gunshots and abuse of children — but otherwise, providers need the consent of the patient or family to release any information. Violators may be punished by a fine of up to $5,000 or six months in prison.

Dr. John B. Murphy, senior vice president for medical affairs at Rhode Island Hospital, said in an interview that the hospital wants to work with the police, but it also must follow the law. He’s participated in meetings with the Providence police about the issue, most recently with then-Chief Dean M. Esserman a few months ago, and said the hospital has been trying to accommodate investigators.

The hospital has recently stopped concealing the identities of all people brought in with violent injuries, Murphy said. The hospital also gave police contact information for the top on-call administrator.

But there is only so much the hospital can do within the law, he said.

“If you think the law needs to be changed, then change the law,” Murphy said. “Why does the law differentiate from a grazing gunshot that just needs a Band-Aid and a life-threatening stab to the liver?”